If you will do a forensic investigate a Macintosh that is running OS X and you need to access a program on a booted forensic copy of the subject’s drive,and if you do not known the password. Follow the steps below;

If you have any version of the Macintosh OS X boot CD or DVD, place that in the examination system and hold

down the C key to boot from the CD/DVD drive.Then the system asks if you want to install/reinstall OS X, choose the Password Reset Utility from the drop-down menus at the top of the screen. You will be shown a list of users and you can pick one or all of them and change the password of the accounts to something you know.

About Me

I have been in IT sector for 10 years. As professionals know everything is not going in rules. I will share my experiences and small tips&tricks about Microsoft Server Family , Cisco Devices , HP and IBM servers and storages on this site.
Egemen TANIRER (Computer Engineer)